No. The features are managed primarily through the SharePoint Admin Center and, to some extent, through PowerShell.
Glossary
As the use of Microsoft 365 increases, so does the number of SharePoint sites, Teams workspaces, OneDrive folders, and shared content in many organizations. SharePoint Advanced Management extends the management and governance capabilities of SharePoint Online and OneDrive. The solution helps identify and more effectively manage risks such as overly broad sharing permissions, unclear responsibilities, and uncontrolled content growth.
Contents
SharePoint Advanced Management, or SAM for short, is a set of advanced management features for SharePoint Online and OneDrive.
These features help companies, in particular, to:
Administration is primarily handled through the SharePoint Admin Center. SAM is specifically designed for Microsoft 365 and SharePoint administrators, as well as those responsible for governance, security, compliance, and risk management.
Important: SAM provides transparency and technical controls. Whether a permission, site, or approval is appropriate for the specific business purpose must still be assessed from an organizational and technical perspective.
SharePoint and Microsoft Teams enable employees to quickly create new workspaces, make documents available, and share information internally or externally. This flexibility supports digital collaboration, but can lead to problems without clear governance rules.
Typical challenges include:
"Content sprawl" refers to the uncontrolled accumulation of content and workspaces that are no longer being adequately managed. "Oversharing " describes the excessive sharing of information.
Such situations do not automatically constitute a security or compliance violation. However, they increase the risk that confidential information will be improperly disclosed, that responsibilities will be unclear, or that internal guidelines will not be reliably implemented. SAM offers additional analysis and control capabilities, but it is no substitute for expert judgment.
Identify content and sites that are growing unchecked, inactive, or lack adequate oversight.
Structure ownership, inactivity, certifications, archiving, and other follow-up processes.
Conduct more targeted reviews of permissions, sharing links, external access, and particularly sensitive areas.
SAM's features combine analysis and reporting with technical control capabilities. This can result in a continuous governance process: Identify → Assess → Control → Monitor.
The Content Management Assessment combines several tenant-wide checks. For example, it can identify inactive or inadequately managed sites, broken permission inheritance, and overly broad permissions. The results include recommendations for action but do not make any changes without an administrator's approval. Microsoft Learn: Content Management Assessment
AI Insights can identify patterns in reports and suggest possible next steps. These suggestions may be based on a subset of the report in question. They are therefore intended as a starting point for analysis, not as a definitive risk assessment. Microsoft Learn: AI Insights
Data access governance reports help identify SharePoint and OneDrive sites with access permissions that may be too broad or particularly sensitive. These include, for example, content available organization-wide, external shares, broad-reaching share links, or unusual permission structures.
Using Site Access Reviews, administrators can flag specific issues from these reports and forward them to the responsible owners of a SharePoint site. The owners then determine whether members, guests, and share links are still needed. This review feature is not currently available for OneDrive accounts.
With Restricted Access Control, access to selected SharePoint or OneDrive sites can be restricted to specific Microsoft 365 groups or Microsoft Entra security groups. Users must then have both the appropriate permission and membership in an authorized group.
In addition, Microsoft Entra authentication contexts can link conditional access policies to selected sites. File-download policies can prevent the downloading of files from areas requiring special protection. Such controls must be carefully planned, as overly broad restrictions can disrupt existing business processes.
Microsoft 365 Copilot generally takes into account the content that the respective user is authorized to access. Permissions that are granted too broadly can therefore affect which information can be found via Copilot or Microsoft 365 Search. The organizational and technical preparations for this are often referred to as “Copilot Readiness.”
Restricted Content Discovery can temporarily limit the discoverability of content from selected SharePoint sites in the organization-wide Microsoft 365 search and in certain Copilot experiences. This feature does not change permissions: Authorized users can still open content directly. It applies only to SharePoint sites, not to OneDrive, and may also hide certain AI entry points—such as agent creation capabilities—on affected sites.
This feature is intended as a temporary protective measure during a review and is not a substitute for data cleansing or authorization checks. Overuse of this feature may degrade the quality of search results and Copilot responses. Microsoft Learn: Restricted Content Discovery
SharePoint sites are created for projects, departments, or teams and eventually become unnecessary. Without a structured lifecycle, many sites remain active indefinitely. This leads to increased storage requirements, administrative overhead, and risks.
Site ownership policies help ensure there are a sufficient number of responsible owners. Policies for inactive sites identify areas that have not been used for some time and can trigger a review by the responsible parties. Recurring site attestations require a deliberate confirmation that a site is still needed and that details such as its purpose, owner, members, and sharing settings are still accurate.
Lifecycle policies can first be tested in simulation mode. Only after evaluation should a decision be made as to whether and for which sites they will be enforced. Microsoft Learn: Policies for Inactive Sites
"Change History" and "Recent Site Actions" help track changes to sites and administrative activities. This supports internal audits, operational reviews, and incident investigations.
Catalog Management allows you to group sites based on organizational criteria. Compare Site Policies makes it easier to compare selected policies and settings across sites. This highlights differences and enables more targeted application of governance requirements.
Enterprise App Insights show which third-party applications access SharePoint content. Agent Insights and Agent Access Insights provide visibility into where AI agents were created and how they interact with SharePoint and OneDrive content.
Restricted Site Creation allows you to limit the creation of new sites to selected user groups or applications. This helps reduce uncontrolled growth. However, before enabling this feature, you should review existing deployment processes, applications, and licensing requirements.
SharePoint Advanced Management may be particularly relevant in the following situations:
It often makes sense to take a step-by-step approach, starting with the most significant risk or the most urgent use case.
When used correctly, SAM can improve transparency, manageability, and traceability in a Microsoft 365 environment.
The most important advantages include:
The benefits do not stem solely from technical activation. Reports identify potential risks but do not automatically take the business context into account. Alerts are only helpful if those responsible act on them. Technical controls are no substitute for internal policies or a comprehensive governance or compliance framework.
SAM is therefore a tool designed to support governance. Objectives, responsibilities, and decision-making processes must continue to be defined by the company.
The available SAM features depend on your existing Microsoft 365 licensing and the specific feature. In general, a supported base subscription is required.
Some of these features are available to administrators as part of a Microsoft 365 Copilot license in a Microsoft 365 tenant. Alternatively, the SharePoint Advanced Management Plan 1 can be purchased in addition to a supported base license. Microsoft 365 E7 also includes the combination of Microsoft 365 E5 and Copilot required for this access. Certain features—in particular, the restricted ability of users or applications to create sites—require Plan 1 and are not covered by a Copilot license alone.
Connected services such as Microsoft 365 Archive, Microsoft Entra Conditional Access, or certain features with sensitivity labels may incur additional licensing or usage costs. Since Microsoft may change the scope and terms, you should always verify specific availability for your tenant and the intended use case. Microsoft Learn: Licensing and Usage Requirements
The key question is not how many SAM functions can be activated. What matters is which specific problem needs to be solved.
Before implementation, companies should clarify the following, among other things:
Policies should first be tested in a limited pilot environment. Where a simulation mode is available, it should be used before active enforcement begins. Using all features to the fullest extent possible is not necessarily the best solution: Excessively strict controls can hinder collaboration, while unprocessed policies generate reports without actually reducing risks.
These questions provide context for SharePoint Advanced Management and its role in Microsoft 365 governance.
No. The features are managed primarily through the SharePoint Admin Center and, to some extent, through PowerShell.
Not entirely. SAM can identify potential risks, trigger reviews, and apply technical restrictions. Whether access is justified from a business perspective must still be evaluated.
No. Many features are useful for permissions management, lifecycle management, and governance even without Copilot. However, with Copilot, having a well-organized permissions and content structure becomes even more important.
No. SAM supports the technical implementation. Objectives, responsibilities, guidelines, and follow-up processes must still be defined at the organizational level.
Which features of SharePoint Advanced Management are appropriate depends on the existing Microsoft 365 environment, governance objectives, licensing, and specific risks. Before implementing them on a broad scale, you should therefore analyze the current situation, prioritize suitable use cases, and test potential impacts on existing processes.
innobit helps companies assess their SharePoint and Microsoft 365 environments, select appropriate governance measures, and implement them in a controlled manner. This includes, for example, analyzing existing structures and permissions, developing a suitable governance strategy, setting up selected SAM functions, and—where appropriate—integrating SmartGovernance365.
SAM is not considered in isolation. Depending on the use case, additional Microsoft features, organizational processes, or other governance solutions may be required. For more information on support, see Microsoft SharePoint Consulting.
SharePoint Advanced Management extends SharePoint and OneDrive with analytics, lifecycle management, and access control features. Organizations can use it to gain greater visibility into content sprawl, clarify responsibilities, investigate oversharing, and more effectively secure areas requiring special protection.
However, the greatest benefit does not come from enabling as many functions as possible. What matters most is identifying the risks involved, determining which processes are already working, and determining which technical and organizational measures are appropriate for each specific use case.
A structured analysis, a limited pilot, and clearly defined responsibilities lay the groundwork for using SAM in a targeted and effective manner.
Would you like to specifically improve permissions, site lifecycle management, or Copilot readiness? innobit analyzes your current situation and helps you select and implement appropriate governance measures in a controlled manner.
